Force Client-SSL Profile to X25519, Instead of Post-Quantum Cryptography
There is a TLS implementation that was working perfectly before, even though, there is SSL ClientHello extension addition, by a middle-box device. With Clienthello packets of 540bytes, this worked perfectly. An example is the "Extension Unknown Type 17516" added there. Recent tests show the extension addition is no longer working. The only significant change is that CLIENTSSL HELLO packets are now fragmented on TLS 1.3 with the Post-Quantum Cryptography implementation on clients (browsers), with CLIENTSSL HELLO now regularly abover 1500 bytes causing fragmentation. How is it possible if F5 is Client-side server to force all clients to use X25519 ciphers instead of X25519Kyber512Draft00 and X25519Kyber768Draft00 to ensure that full flow is not broken. is there any changes on CLIENTSSL Profile to implement this. Traffic Flow is Mobile browser--Mobile Packet gateway (header enrichment)-- F5 (Server)
Guest Role User Lost Visibility in ASM/WAF Module – LTM Working Fine
Hi community, I'm troubleshooting a strange issue on our F5 BIG-IP and hoping someone has run into this before. Environment: - Module: ASM (WAF) - User Role: Guest - Partition Access: All Partitions Problem: A user with the Guest role and access to all partitions suddenly lost the ability to view any information in the ASM module. When navigating to Security > Application Security > Policies, the table shows "No records to display" — even though policies exist and are active and viewable from other non-guest accounts. The strange part: LTM is working perfectly fine for this user. They can view virtual servers, pools, nodes, etc. without any issue. The problem is isolated to ASM only. Any pointers would be greatly appreciated. Happy to share outputs if needed. Thanks!Need step-by-step guidance for migrating BIG-IP i2800 WAF to rSeries (UCS restore vs clean build)
Hello DevCentral Community, We are planning a hardware refresh migration from a legacy BIG-IP i2800 running WAF/ASM to a new rSeries platform and would like to follow F5 recommended best practices. Could you please advise on the step-by-step process for this migration, specifically around: o Whether UCS restore is recommended versus building config fresh o BIG-IP version compatibility considerations during the migration o Interface/VLAN mapping differences between iSeries and rSeries hardware o Best approach to migrate WAF/ASM policies and tuning after migration o Common issues or lessons learned during real-world cutovers Current environment: " BIG-IP model: i2800 " BIG-IP version: 17.1.3 " WAF module: ASM / Advanced WAF " Deployment: Active/Active Thank you .Bigip Restoration From Hardware to VM
Hi All, I wanted to know about the prerequisites and the proper steps to do the restoration test from an F5 r2600 Device to an F5 Bigip VM. So I have tried it and it comes with multiple errors 2026 Mar 17 18:10:15 Hostname.COM logger[3452]: Re-starting named Reloading License and configuration - this may take a few minutes... Broadcast message from [email protected] (Tue 2026-03-17 18:10:21 IST): load_config_files[4013]: "/usr/bin/tmsh -n -g -a load sys config partitions all " - failed. -- 010713d0:3: Symmetric Unit Key decrypt failure - decrypt failure Unexpected Error: Loading configuration process failed. 2026 Mar 17 18:10:21 Hostname.COM load_config_files[4013]: "/usr/bin/tmsh -n -g -a load sys config partitions all " - failed. -- 010713d0:3: Symmetric Unit Key decrypt failure - decrypt failure Broadcast message from [email protected] (Tue 2026-03-17 18:10:21 IST): load_config_files[4542]: "/usr/bin/tmsh -n -g -a load sys config partitions all base " - failed. -- 010713d0:3: Symmetric Unit Key decrypt failure - decrypt failure Unexpected Error: Loading configuration process failed. 2026 Mar 17 18:10:21 Hostname.COM load_config_files[4542]: "/usr/bin/tmsh -n -g -a load sys config partitions all base " - failed. -- 010713d0:3: Symmetric Unit Key decrypt failure - decrypt failure Configuration loading error: base-config-load-failed For additional details, please see messages in /var/log/ltm Is it all coming due to a mismatch of the Master Key or something? Both devices are in the same version, and I also verified the resource provisioning. I wanted to know the reason for this and also the proper steps to test restoration from F5 hardware to VM. SME's Kindly help me on this..
How to Perform Redundancy Switchover on BIG-IP
Regarding Redundancy Switching Methods on BIG-IP Can I understand that the following ① and ② exhibit identical behavior? If there is a difference in operation, please let me know. ① Force to Standby on the Active Unit ② Force to Offline ⇒ Release Offline on the Active UnitLB Connection Limit Detection Method
We have set a connection limit on the load balancer. If there is a way to detect when the upper limit of the connection limit is exceeded, please let us know. We are considering detection via log monitoring, but we would like to confirm if there are other methods available.
Configuration Assistance: Configure Email Alerts for HA Failover Events and Device Offline
We have a BIG-IP VE High Availability Pair deployed in Microsoft Azure. We need to configure the BIG-IP to automatically send an email notification to our Operations teams immediately when a Failover event occurs(When the unit goes from Active to Standby or Offline) Could you provide the recommended procedure for the configuration to trigger these email alerts?F5 ASM with fortisandbox
Hi i want to integrate f5 ASM with fortisandbox as a icap server for file upload inspection i found this articale https://support.f5.com/csp/article/K70941653 but Value of virus_header_name for fortisandbox is not mentioned any one has experince of integration with fortisandbox. please let me know if anyone know virus_header_name for fortisandbox
F5 Open telemetry issue
Hi all, we have the issue with TS on f5, we installed TS package, set up declaration but when we are checking f5 url/telemetry we dont see atribute which we should see in the attachment you can see the declaration we have used and posted on f5 expecting to see everything, but we see only some basic status, not eg: f5 pool active members, f5 pool availability we dont see any errors in /var/log/restnoded/restnoded.log and when we check url: localhost/mgmt/shared/telemetry/pullconsumer/metrics we see nothing useful. Any help would be appreciated.
